Network General - added an EdgeRouter X as an OpenVPN server

I had attempted to use one of the GL-iNet routers (AR800M) to act as an OpenVPN server on my network.  I setup one of the vlans from the Main Router and had a whole lot of problems with the setup.  I discovered that the EdgeRouter-X (ER-X) was only $65 from MicroCenter and a lot of people indicated that is was an easy setup for OpenVPN.  I decided that what I would do was setup a vlan from the Cisco router with one of my unused vlans that flows throughout the network.  So I designated one of my many vlans to be an “OpenVPN passthrough”.  This will be similar in concept to the No-Mans Land vlan that I have been using for some time.  The “OpenVPN passthrough” vlan will be setup so that you cannot change the Cisco router and you cannot access any other vlan.  I will also punch some ports through the Cisco router to the Wan port of the ER-X.  The OpenVPN setup is shown at https://help.ui.com/hc/en-us/articles/115015971688-EdgeRouter-OpenVPN-Server.  I have found this to be a very easy setup.  I also generated some additional OpenVPN client cents to use with my cell phones, iPads, and laptops.

An Issue Has Arisen - VLAN Crossover

Methinks that the default setup for Mac OS X Mavericks opens the same ports for every VLAN that has been defined.  I thought that I was going crazy here because I thought that the default was no crossover connections between VLANs within my network.  I have been very careful to make sure that the router and switch setups do not cross over.  However, it would seem that Mavericks puts the same ports on each vlan that is defined in the Setup.  I don't want this, I want a separate set of ports to be open for each vlan from the Mac Mini.  The reason for this is that I want to do some SDN type things using Fusion on the Mac Mini, now I am not so sure that I will be able to do it.  I don't really understand PF as I am more of a Linux guy.  I will update as I find the answer.

Rearranging the Network for Fun

Well how annoying.  I haven't been blogging to this page for a while so I might want to catch up with what has been going on in the network at home.  I recently added a Personal Weather Station (PWS) and a Cisco router to the mix.  I find that once again I am not really trusting of the Verizon folk and I want to keep separate from them as much as is possible.

I did some wiring changes to the 4th switch so that the router only needs 2 wires through the wall; one from the switch in the side room (connected to the other 3 switches, with trunk lines) and one directly from the Verizon FIOS ActionTec router (as the WAN input).  The PWS is connected from a Raspberry Pi to a 3rd wire into the side room and into the 4th switch where it goes into a port with a "patch" VLAN that keeps the flow of information outside of my home network.  This "patch" VLAN then goes from switch #1 to the ActionTec.  Thus, I only have two connections now to the ActionTec.  I have effectively isolated the traffic from the PWS from everything else (as long as the switch on the ActionTec router acts like a switch).

I am also in the process of standing up a Ceton InfiniTV 6 to replace my HD HomeRun Prime.  The difference is 6 tuners instead of 3, and this is a pooled device; meaning I just grab one of the tuners from whatever is connected to it.  Since I really don't believe that my ZTec will be able to keep up with 6 tuners, I am going to stand up a Windows VM in the Mac Mini to host the Windows Media Center to the two Ceton Echo WMC extenders.

I might also use the 1 to 1 NAT capability of the Cisco router so that I can access all media devices from the subnet on the ActionTec.  This will simplify the use of iPhone/iPad apps to control the media devices.

I have some time this weekend to start making all of this work together.  Hopefully, I can get it into some form that will be acceptable to the wife and we can start getting rid of the FIOS Stb and VCRs to save some rental fees ($33 each month).

Changing up the netwok for security

Well, after taking a CEH course at night, I have decided that I need to figure out a mechanism to protect my network from intruders.  This is more of  an exercise for me to apply some of the things that I have learned in the class.  I have a number of different VLANs in the house, some pretty benign and some not so much (like access to TOR, etc.).  Any one of these could lead to compromises in the network so I would like to re-evaluate what I am doing and make changes as necessary.  I will be taking the CEH cert test in the next couple of weeks and that will free up time for me to become more involved in this process.

One specific thing that I would like to try is separation of connections from known or unknown entities to a special VLAN for that purpose.  I want to separate out all of the internal networks from being compromised.  In addition, I would like to put up an intrusion detection system for the existing networks and go about looking for unusual traffic patterns.  Of course, one of the quirks about my setup is that I have everything going through an ActionTec router which can be almost a sieve without proper configuration.  Updates to the firmware do not appear to be forthcoming and Verizon is insistent on my spending another $100 to get their "improved" ActionTec router just so I can get gigabit Ethernet to my other router connections.

One of the first things that I think I will try is to make all of the connections from the ActionTec router to be on separate VLANs.  There really is no need for me to have everything on the same subnet and the router does have the ability to have completely separate VLANs from it.

Project #8 - Update the Network for Security

After taking some classes in CEH, I have decided that I need to really look at my network and make sure that security is taken care of.